Emby
9 CVEs across 4 Emby products. Browse Emby vulnerabilities, severities, and proof-of-concept exploits.
Emby products with known CVEs
Emby CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-64113 | Critical | 9.8 | 2025-12-09 | Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby S… |
CVE-2025-64325 | Critical | 9.0 | 2025-11-18 | Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request wi… |
CVE-2025-46391 | Medium | 6.5 | 2025-08-06 | CWE-284: Improper Access Control |
CVE-2025-46390 | High | 7.5 | 2025-08-06 | CWE-204: Observable Response Discrepancy |
CVE-2025-46389 | Medium | 6.5 | 2025-08-06 | CWE-620: Unverified Password Change |
CVE-2025-46388 | Medium | 4.3 | 2025-08-06 | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2025-46387 | High | 8.8 | 2025-08-06 | CWE-639 Authorization Bypass Through User-Controlled Key |
CVE-2025-46386 | High | 8.8 | 2025-08-06 | CWE-639 Authorization Bypass Through User-Controlled Key |
CVE-2025-46385 | High | 8.6 | 2025-07-20 | CWE-918 Server-Side Request Forgery (SSRF) |
CVE-2025-46384 | High | 8.8 | 2025-07-20 | CWE-434 Unrestricted Upload of File with Dangerous Type |
CVE-2025-46383 | Medium | 6.1 | 2025-07-20 | CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') |
CVE-2023-4167 | Low | 3.5 | 2023-08-05 | A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic. This issue affects some unknown processing of the file /web/. Th… |
CVE-2021-25828 | Medium | 6.1 | 2023-06-28 | Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web. |
CVE-2021-25827 | Critical | 9.8 | 2023-06-28 | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address. |
CVE-2023-33193 | Critical | 9.1 | 2023-05-30 | Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewin… |
CVE-2022-36223 | Medium | 6.1 | 2022-12-16 | In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the… |
CVE-2021-32833 | High | 8.6 | 2021-09-09 | Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnera… |
CVE-2020-26948 | Critical | 9.8 | 2020-10-10 | Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter. |